<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">After some further research into the requests being sent, it looks like the namespace is being defined properly in the original message, but aren’t being used by the parser that tries to interpret the decrypted NameID snippet. This issue to be described by this comment I found in OpenSAML’s Decryptor:<div style="margin: 0px; line-height: normal; min-height: 14px;" class=""><br class=""></div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(78, 144, 114);" class=""><span style="color: #000000" class=""> </span>// Since Xerces currently seems not to handle parsing into a DocumentFragment</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(78, 144, 114);" class=""><span style="color: #000000" class=""> </span>// without a bit hackery, use this to simulate, so we can keep the API</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(78, 144, 114);" class=""><span style="color: #000000" class=""> </span>// the way it hopefully will look in the future. Obviously this only works for</div><div style="margin: 0px; font-size: 11px; line-height: normal; font-family: Monaco; color: rgb(78, 144, 114);" class=""><span style="color: #000000" class=""> </span>// input streams containing valid XML instances, not fragments.</div><div class="">
<div style="color: rgb(0, 0, 0); font-style: normal; font-variant-caps: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><p style="font-family: Helvetica; font-size: 12px; font-weight: normal;" class="">I’m trying to run in a Tomcat8 container running under OpenJDK 1.7 - is it possible that I should be using a particular version of Xerces that is better behaved? Just for reference, here’s my original request:</p><div class=""><br class=""></div><div class=""><div class=""><samlp:LogoutRequest</div><div class=""> Destination="<a href="https://samwise.dev.lotame.com/idp/profile/SAML2/Redirect/SLO" class="">https://samwise.dev.lotame.com/idp/profile/SAML2/Redirect/SLO</a>"</div><div class=""> ID="ONELOGIN_f66b05f5054fc178a60729d485c5a9d6022ce7b4"</div><div class=""> IssueInstant="2017-04-07T20:17:26Z" Version="2.0"</div><div class=""> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"></div><div class=""> <saml:Issuer>{Actual Issuer here}</saml:Issuer></div><div class=""> <saml:EncryptedID></div><div class=""> <xenc:EncryptedData</div><div class=""> Type="<a href="http://www.w3.org/2001/04/xmlenc#Element" class="">http://www.w3.org/2001/04/xmlenc#Element</a>"</div><div class=""> xmlns:dsig="<a href="http://www.w3.org/2000/09/xmldsig#" class="">http://www.w3.org/2000/09/xmldsig#</a>" xmlns:xenc="<a href="http://www.w3.org/2001/04/xmlenc" class="">http://www.w3.org/2001/04/xmlenc</a>#"></div><div class=""> <xenc:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#aes128-cbc" class="">http://www.w3.org/2001/04/xmlenc#aes128-cbc</a>"/></div><div class=""> <dsig:KeyInfo xmlns:dsig="<a href="http://www.w3.org/2000/09/xmldsig" class="">http://www.w3.org/2000/09/xmldsig</a>#"></div><div class=""> <xenc:EncryptedKey></div><div class=""> <xenc:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" class="">http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</a>"/></div><div class=""> <xenc:CipherData></div><div class=""> <xenc:CipherValue>dsVpBN1xCKk2e+vaFFSKrdk2z3RVJ8TkJ+1Lt5g/c7YM2M1rX9c7/YGCSMOXU7S6</div><div class="">SfCHns4EM+9yqsLBVWMlFwpTONc8YTNojl8T3F6tua8qLLu02RL/Zqf+TlN8vK+Z</div><div class="">zrTAl6c3LnzcdZtG/DIiG2GgcOX6VJCrBr39Lfs2zfg86cd3xj24skGWTMr0v4je</div><div class="">wh0t1/lZbLRePBWHXlr5kpzbGJsD+uoRkyoi8k817jN2ziZ7Xr2cBsDuJH2hJKU7</div><div class="">d/vvzcfPykdgUcjxJhpZu+gvbpPYA7VFNNaIC4w3TORRtA75DzK9NTasSuuat2rC</div><div class="">cneGPoZVS5Qa4sGu4QfN8w==</xenc:CipherValue></div><div class=""> </xenc:CipherData></div><div class=""> </xenc:EncryptedKey></div><div class=""> </dsig:KeyInfo></div><div class=""> <xenc:CipherData></div><div class=""> <xenc:CipherValue>urRsXcfYUKD/0VaeTZwNOHbKn5r1CtjIQUT/H1c0jSfoLLb43bPlvI/Kz4JcWALF</div><div class="">cHXeTyvNKMxhAKdS467O8iU9qrSQxeQTjnf515mX4s1z+L4yzxexhy0uBHnaAOWV</div><div class="">p87ZzSrJe4IOBqNvYdox4ISzQM6YjF1Itv58m5fc6c8=</xenc:CipherValue></div><div class=""> </xenc:CipherData></div><div class=""> </xenc:EncryptedData></div><div class=""> </saml:EncryptedID></div><div class=""> <samlp:SessionIndex>_ab0335715e51f8c0c3ba498f54bb223b</samlp:SessionIndex></div><div class=""> </samlp:LogoutRequest></div></div><div class=""><br class=""></div><div class="">and the decrypted NameID that the parser is balking at:</div><div class=""><br class=""></div><div class=""><div style="margin: 0px; font-size: 10px; line-height: normal; font-family: Monaco; color: rgb(244, 244, 244); background-color: rgba(0, 0, 0, 0.85098);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress”>{Actual email address here}</saml:NameID></span></div></div><div class=""><br class=""></div><div class="">Thanks for your help,</div><div class=""><br class=""></div><div class="">Curtis</div><div class=""><br class=""></div></div></div>
<br class="">
<br class=""><div><blockquote type="cite" class=""><div class="">On Apr 6, 2017, at 2:52 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><blockquote type="cite" class="">Hi, I'm trying to set up a Shibboleth 3.3 IdP, and having trouble processing the<br class="">logout requests from a particular SP. Once decrypted, the logout requests<br class="">look like this:<br class=""></blockquote><br class="">That's a decrypted NameID, not the whole request. When you embed namespace usage in encrypted content, it's a basic requirement that you have to ensure the prefix(es) get declared either within the content or in the original message.<br class=""><br class=""><blockquote type="cite" class="">Is there a bean or property that I need to provide which defines this "saml"<br class="">prefix?<br class=""></blockquote><br class="">No, the message is simply broken, and the SP has a bug. I can't imagine that's Shibboleth but if it is you should certainly file it.<br class=""><br class="">-- Scott<br class=""><br class="">-- <br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a><br class=""></div></div></blockquote></div><br class=""></body></html>
<br>
The information transmitted in this email is intended only for the person(s) or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this email in error, please contact the sender and permanently delete the email from any computer.